3 ms·

Actually, it appears to me that almost 100% of “security questions” used during support phone calls are completely insecure. Usually they'll ask a few (2~3 is

by riobard 14y ago

Actually, it appears to me that almost 100% of “security questions” used during support phone calls are completely insecure. Usually they'll ask a few (2~3 is normal) questions like your full name, date of birth, address with zipcode, email address, etc. Notice the problem of these? All of them, I mean, ALL, are PUBLIC INFORMATION THAT ANYONE KNOWS SOMETHING ABOUT YOU WILL HAVE. This is almost as silly as credit cards, where you are supposed to give the card number, card holder's name (not required most of the time), expire date, and the 3-digit PIN. Anyone who touches your card will have that information, once and forever. Yes, ANYONE, that includes your grocery store cashiers, your favorite bar tenders, your mobile phone billing representatives, etc. The list could go on very, very long. And I'm totally amazed that both systems persist as a fallback plan in this digital world with countless attacking vectors.

shawndumas 14y ago
As I've said elsewhere: "Keep in mind though; you can answer anything you want. Use a 1password generated string for each and store the answers redundantly. That's what I did."
- riobard 14y ago
  Based on my experience, that's not how it works at all in practice. They will ask these info about your real identity as recorded in their CRM systems. I doubt you can list your name as BLAH BLAH BLAH there and still receive your package delivered correctly.
- r00fus 14y ago
  If a human is in the loop and you need to call in to verify - this could get quite difficult unless you use the "pronounceable" option in password generation.
pja 14y ago
The thing to remember here is that where the liability lies matters. The banks effectively take on all the liability for financial losses due to credit card fraud & they're free to setup their systems to constrain losses to a level that they're happy with. Yes, arguably not all the losses fall on the banks, particularly the hassle and time of recovering from a particular instance of fraud but the majority of them probably do and that's what matters because the interests of those who bear the losses and those who run the system are aligned. The trouble with cloud systems is that all the losses fall on the end user who has no influence over the security systems put in place to protect their data. (Except with Google where you can at least choose to use 2-factor authentication.)
- maxerickson 14y ago
  Banks are experts at pushing financial liability onto others. Much of the time, credit card companies inform the merchant that they aren't going to pay for a transaction that they have deemed fraudulent. The merchant can chase the fraud themselves or eat the loss. The fact that 'identity theft' is a commonly used name for bank fraud is another example. When some bank opens an account for person Y, there should be zero consequences for person X (regardless of any fraud committed by Y), but the banking system isn't quite set up that way.

by riobard 14y ago

shawndumas 14y ago

As I've said elsewhere: "Keep in mind though; you can answer anything you want. Use a 1password generated string for each and store the answers redundantly. That's what I did."

riobard 14y ago
Based on my experience, that's not how it works at all in practice. They will ask these info about your real identity as recorded in their CRM systems. I doubt you can list your name as BLAH BLAH BLAH there and still receive your package delivered correctly.
r00fus 14y ago
If a human is in the loop and you need to call in to verify - this could get quite difficult unless you use the "pronounceable" option in password generation.

pja 14y ago

The thing to remember here is that where the liability lies matters. The banks effectively take on all the liability for financial losses due to credit card fraud & they're free to setup their systems to constrain losses to a level that they're happy with. Yes, arguably not all the losses fall on the banks, particularly the hassle and time of recovering from a particular instance of fraud but the majority of them probably do and that's what matters because the interests of those who bear the losses and those who run the system are aligned. The trouble with cloud systems is that all the losses fall on the end user who has no influence over the security systems put in place to protect their data. (Except with Google where you can at least choose to use 2-factor authentication.)

maxerickson 14y ago
Banks are experts at pushing financial liability onto others. Much of the time, credit card companies inform the merchant that they aren't going to pay for a transaction that they have deemed fraudulent. The merchant can chase the fraud themselves or eat the loss. The fact that 'identity theft' is a commonly used name for bank fraud is another example. When some bank opens an account for person Y, there should be zero consequences for person X (regardless of any fraud committed by Y), but the banking system isn't quite set up that way.